# from scapy.all import *
from capture import *
from data_type import * 
from datetime import *
import pickle as pickle

def dnsDetection():
    flowForDnsD = []
    
    # ###########################从pkl文件中获取flowForDnsD列表###########################
    # Ethernet = EthernetPkt()
    # Ipv4 = Ipv4Pkt()
    # Ipv6 = Ipv6Pkt()
    # Tcp = TcpPkt()
    # Udp = UdpPkt()
    # Arp = ArpPkt()
    # Dns = DnsPkt()
    # Icmpv4 = Icmpv4Pkt()
    # Icmpv6 = Icmpv6Pkt()
    # HttpReq = HttpReqPkt()
    # HttpRes = HttpResPkt()
    
    # eachPkt = Packet(Ethernet, Ipv4, Ipv6, Tcp, Udp, Arp, Dns, Icmpv4, Icmpv6, HttpReq, HttpRes)
        
    #with open("C://Users//leslie//Desktop//res//cur//demo.pkl",'rb') as f:
    with open("attack_demo//dns.pkl",'rb') as f:
    #with open("sniffRes//cur//dns.pkl",'rb') as f:
        while 1:
            try:
                dnsPkt = pickle.load(f)
                flowForDnsD.append(dnsPkt)
                # print(eachPkt)
                # eachPkt.PrintFlag()
            except EOFError:
                break
    ###########################从pkl文件中获取flowForDnsD列表###########################
    count = 0
    return_list = []
    seenResponses = {}
    for pkt in flowForDnsD:
        #print(type(pkt))
        if IP in pkt:
               if pkt.haslayer(DNS) and pkt.getlayer(DNS).qr == 0:
                    seenResponses[pkt[DNS].id] = None
                    #print("1:")
                    #print(seenResponses)
               elif pkt.haslayer(DNS) and pkt.getlayer(DNS).qr == 1:
                    if seenResponses[pkt[DNS].id] == None:
                        seenResponses[pkt[DNS].id] = [pkt[IP].payload, pkt[DNSRR].rdata]
                        #print("2:")
                        #print(seenResponses)
                    elif seenResponses[pkt[DNS].id][0] == pkt[IP].payload:
                        #print("3:")
                        #print ("Retransmission Occurred")
                        seenResponses[pkt[DNS].id].append(pkt[DNSRR].rdata)
                        #print(seenResponses)
                    else:
                        #print("4:")
                        print (datetime.now().strftime('%Y-%m-%d %H:%M:%S'), "DNS poisoning attempt\n", "TXID ", str(pkt[DNS].id), " Request ", pkt[DNS].qd.qname, "\n", "Answer1 ", str(pkt[DNSRR].rdata), " Answer 2 ", str(seenResponses[pkt[DNS].id][1:]))
                        print(datetime.now().strftime('%Y-%m-%d %H:%M:%S'))
                        count += 1
                        print( "=================================================================")
                        return_list.append((count, datetime.now(),(str(pkt[DNS].id)),(pkt[DNS].qd.qname),(str(pkt[DNSRR].rdata)),(str(seenResponses[pkt[DNS].id][1:]))))
                        # return datetime.now(),(str(pkt[DNS].id)),(pkt[DNS].qd.qname),(str(pkt[DNSRR].rdata)),(str(seenResponses[pkt[DNS].id][1:]))
            # remove this entry from seenResponses as for a new query it should start from initial state i.e no IP seen
                        del seenResponses[pkt[DNS].id]
    return return_list